{ "schema": "aaes/capability-pack/1", "provider": "microsoft365", "version": "1.1.0", "description": "Read Microsoft 365 users, mailbox messages, and calendar events; send mail, create events that can invite attendees, and post Teams channel messages. Ordinary Teams posting needs a separate delegated user token.", "notes": "USER_ID (a user id or userPrincipalName), TEAM_ID and CHANNEL_ID in the endpoint paths are placeholders: the deployment must substitute the concrete user, team and channel each capability is bound to before enabling the pack, and the pack must not be enabled with the literals in place — the review does not rely on Microsoft Graph rejecting literal placeholder identifiers as the control. The egress allowlist stays graph.microsoft.com, a real shared API host, not a placeholder.\n\nUse an app registration whose Microsoft Graph permissions cover only what these capabilities need; the pack does not create one.\n\nThe pack registers endpoints; the deployment chooses scopes, and the application-permission vs delegated-permission distinction is the deployment's decision: application permissions (User.Read.All, Mail.Read, Mail.Send, Calendars.ReadWrite) are tenant-wide daemon-grade power consented by an admin, while delegated permissions act as one signed-in user within that user's own access. microsoft365.teams.channel_message.send carries its own credential reference, secret-ref-msgraph-delegated-token, and the contract is deliberately different from the pack-level reference: Microsoft documents application permissions for posting a channel message only in the migration flow (Teamwork.Migrate.All, against a channel in migration mode), while ordinary channel posting requires the delegated ChannelMessage.Send permission.\n\nThe stored value under the Teams reference is therefore a delegated Graph access token obtained and renewed by an external process (delegated flows can issue refresh tokens, and that external process owns the refresh) as the complete 'Bearer ' header value; the pack-level client-credentials credential cannot perform ordinary channel posting, the migration scenario is not registered by this pack, and the two references are not interchangeable. sendMail and the Teams post both carry the send action at the minimum R3 tier, and send is one of the designated actions requiring human approval: a message that has left cannot be recalled after delivery.\n\nCalendar event creation declares create and send at the minimum R3 tier: Microsoft documents that creating an event that includes attendees sends invitations to all attendees, dispatched by the server, and that this cannot be configured — so the unrestricted operation carries the send verb, not a reviewer warning; a create-only R2 variant would require an actually enforced restriction excluding invitation dispatch, which this pack does not register.\n\nThis pack registers only Microsoft Graph v1.0 endpoints: nothing from the beta endpoint, and no $batch, change notifications or subscriptions, delta queries, OneDrive or SharePoint drives, Teams chats (as opposed to channels), or mail, calendar or Teams update and delete operations — documented exclusions, not approximated capabilities. This pack complements rather than duplicates Microsoft Agent 365's own controls: Agent 365 governs agents on Microsoft's agent platform, while AAES governs any agent calling Microsoft Graph here regardless of which agent platform it runs on.\n\nAAES has not been certified by Microsoft; the endpoints here are configuration to review and test; the vendor has not endorsed it.", "credential": { "secret_ref_id": "secret-ref-msgraph-app-credential", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "The value stored under this reference is the complete Authorization header value (scheme included): 'Bearer ' followed by an OAuth2 access token for Microsoft Graph, minted with the client credentials flow from the client's own app registration against login.microsoftonline.com — POST /{tenant}/oauth2/v2.0/token with scope https://graph.microsoft.com/.default — and placed in the client's own secret manager by an external deployment process.\n\nThis grant issues no refresh token, so there is no refresh path to review: renewal ownership sits with the external process, which obtains a replacement access token before the current one expires (access tokens last about an hour) and stores the new complete header value.\n\nThe stored value is never the client secret or certificate assertion material — those stay with the external token process, and a certificate credential is preferable to a client secret for the app registration. Tokens can be revoked by rolling or removing the app registration's credentials; an expired or revoked value fails closed.\n\nWith client credentials there is no signed-in user, so the token carries application permissions: consent only the minimum set that makes these capabilities work, and weigh before consenting that Mail.Send as an application permission lets the app send mail as any user in the tenant.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack. The Teams channel capability uses a different reference with a delegated-token contract — see the pack notes." }, "capabilities": [ { "capability_id": "microsoft365.users.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/users", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-app-credential", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "m365-directory", "description": "List the tenant's users: display names, mail addresses, phone numbers and job titles are personal data, so the read is classified as pii (personal data).", "requires_review": true }, { "capability_id": "microsoft365.mail.messages.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/users/USER_ID/messages", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-app-credential", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "m365-mailbox", "description": "Read the messages in one user's mailbox, including Deleted Items. Message bodies, senders and recipients are personal data, so the read is classified as pii (personal data). USER_ID is a placeholder to replace before enabling.", "requires_review": true }, { "capability_id": "microsoft365.mail.send", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/users/USER_ID/sendMail", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-app-credential", "inject": "header", "inject_name": "Authorization", "actions": [ "send" ], "resource_id": "m365-mailbox", "description": "Send mail as one user. A sent message cannot be recalled after delivery, and send is one of the designated actions requiring human approval, which is why it carries the minimum R3 tier. Recipients are personal data and the body may carry more, so the capability registers at the pii class. USER_ID is a placeholder to replace before enabling.", "requires_review": true }, { "capability_id": "microsoft365.calendar.events.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/users/USER_ID/events", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-app-credential", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "m365-mailbox", "description": "Read the events in one user's calendar, which lives in the mailbox. Attendees, organizers, subjects and bodies are personal data, so the read is classified as pii (personal data). USER_ID is a placeholder to replace before enabling.", "requires_review": true }, { "capability_id": "microsoft365.calendar.events.create", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/users/USER_ID/events", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-app-credential", "inject": "header", "inject_name": "Authorization", "actions": [ "create", "send" ], "resource_id": "m365-mailbox", "description": "Create an event in one user's calendar. When the created event includes attendees, the server sends invitations to all attendees, and Microsoft documents that this dispatch cannot be configured — so the capability declares create and send at the minimum R3 tier: send is one of the designated actions requiring human approval, and a dispatched invitation cannot be recalled after delivery even though the calendar entry itself can later be deleted. USER_ID is a placeholder to substitute before enabling.", "requires_review": true }, { "capability_id": "microsoft365.teams.channel_message.send", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "graph.microsoft.com" ], "endpoint": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID/messages", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-msgraph-delegated-token", "inject": "header", "inject_name": "Authorization", "actions": [ "send" ], "resource_id": "teams-channel", "description": "Post a message to a Teams channel. Recipients may have seen a posted message even if it is later removed, and send is one of the designated actions requiring human approval, which is why it carries the minimum R3 tier. The posted message lands in a channel whose messages are personal data, and Microsoft documents that the created chatMessage carries the sender's user identity and display name, so the capability is classified pii (personal data), the same class as the teams-channel resource and the mail send capability.\n\nThis capability uses its own credential reference, secret-ref-msgraph-delegated-token: a delegated Microsoft Graph access token carrying the ChannelMessage.Send delegated permission, obtained and renewed by an external process — Microsoft supports application permissions for this operation only in the migration scenario (Teamwork.Migrate.All against a channel in migration mode), which this pack does not register.\n\nSee the pack notes; TEAM_ID and CHANNEL_ID are placeholders to substitute before enabling.", "requires_review": true } ], "resources": [ { "resource_id": "m365-directory", "kind": "api", "locator": "https://graph.microsoft.com/v1.0/users", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "m365-mailbox", "kind": "mailbox", "locator": "https://graph.microsoft.com/v1.0/users/USER_ID", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "teams-channel", "kind": "channel", "locator": "https://graph.microsoft.com/v1.0/teams/TEAM_ID/channels/CHANNEL_ID", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-10-22", "sources": [ "https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/api/user-list-messages?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/api/user-sendmail?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/api/user-list-events?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/api/user-post-events?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/api/channel-post-messages?view=graph-rest-1.0 (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow (retrieved 2026-09-21)", "https://learn.microsoft.com/en-us/graph/permissions-reference (retrieved 2026-09-23)" ], "reviewer_id": "owner-delegated" } }